In which James learns that redirect_to is not instant.

session_controller.rb

class SessionController < ApplicationController
  def index_attempt_one
    if !session[:unset_key]
      redirect_to :action => 'login'
    end
    # Anything here gets executed too! D-:
  end

  def index_attempt_two
    if !session[:unset_key]
      redirect_to :action => 'login'
    else
      # Now we are safe. -_-
    end
  end
end